diff --git a/deploy/windows/installer/ShopDBFlask.iss b/deploy/windows/installer/ShopDBFlask.iss
index cf147c7..fa82b61 100644
--- a/deploy/windows/installer/ShopDBFlask.iss
+++ b/deploy/windows/installer/ShopDBFlask.iss
@@ -885,8 +885,15 @@ begin
         MsgBox('Enter the username the application connects with.', mbError, MB_OK);
         Result := False;
       end
+      // Blank is allowed when the password is already ON DISK in a form the
+      // installer can read: .env from a previous install, or the ACL'd .dbpass
+      // handoff stage 0 leaves when it created the database itself. Stage 2
+      // consumes .dbpass on its own, so demanding the password here blocked the
+      // operator on something the installer already had - and sent them looking
+      // for a generated secret they were never meant to handle.
       else if (DbCredsPage.Values[1] = '') and
-              (not FileExists(InstalledDir + '.env')) then
+              (not FileExists(InstalledDir + '.env')) and
+              (not FileExists(InstalledDir + '.dbpass')) then
       begin
         // Only required on a FRESH install. On an upgrade, blank means "keep the
         // password already in .env", so the operator never has to know it.
@@ -933,6 +940,13 @@ begin
   if (CurPageID = DbDetailsPage.ID) and (not DbPageReady) then
   begin
     DbPageReady := True;
+    // A stage-0 handoff means the database was created by a previous run of this
+    // installer and the password is already on disk. Nobody should be asked to
+    // find or retype a secret the installer generated.
+    if FileExists(InstalledDir + '.dbpass') then
+      DbCredsPage.SubCaptionLabel.Caption :=
+        'This server already has a database created by this installer. Leave the '
+        + 'password blank and it will be used automatically.';
     if LoadStringsFromFile(InstalledDir + '.env', Lines) then
       for I := 0 to GetArrayLength(Lines) - 1 do
         if Pos('DATABASE_URL=', Lines[I]) = 1 then